CVE-2018-4090

MEDIUM

Apple tvOS < 11.2.5 - Kernel Memory Read Restriction Bypass

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-4090. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit demonstrates an information leak vulnerability in macOS (CVE-2018-4090) where uninitialized kernel memory is disclosed via the `vfs.generic.conf` sysctl interface due to a padding byte in the `vfsconf` structure.

Description

An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · cdosmacos
https://www.exploit-db.com/exploits/43923

This exploit demonstrates an information leak vulnerability in macOS (CVE-2018-4090) where uninitialized kernel memory is disclosed via the `vfs.generic.conf` sysctl interface due to a padding byte in the `vfsconf` structure.

Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: macOS 10.13 (Darwin 17.0.0)
No auth needed
Prerequisites: Access to a vulnerable macOS system
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (8)

Core 8
Core References
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT208462
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT208465
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1040265
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/43923/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/102782
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT208464
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1040267
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT208463

Scores

CVSS v3 5.5
EPSS 0.0450
EPSS Percentile 89.4%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (4)
apple/apple_tv < 11.2.5
apple/iphone_os < 11.2.5
apple/mac_os_x < 10.13.3
apple/watchos < 4.2.2
Published Apr 03, 2018
Tracked Since Feb 18, 2026